u/_clickfix_

The PWN giveaway is back, and to win all you have to do is ask a question.

Asking a question in our upcoming AMA with Hieu Ngo automatically enters you to win.

The AMA: Hieu Minh Ngo is a former black hat hacker who sold the stolen identities of nearly 200 million people and served over 7 years in US federal prison. Now Hieu runs Chong Lua Dao, a Vietnamese non-profit that fights online scams and scam compounds.

He goes live Wednesday, August 26th from 12 PM to 1 PM ET.

👉 Ask your question here: https://www.reddit.com/r/pwnhub/s/BYlCEj71sY

Prizes:

🥇 $200 Gift Card - Hak5

🥈 $50 (2 winners) - 0ff by 0ne

🥉 $25 (2 winners) - 0ff by 0ne

Hak5 has been building iconic pentest gear since 2005, including the WiFi Pineapple, the USB Rubber Ducky, and the OMG cable collection.

0ff by 0ne makes metal style shirts featuring malware and threat actors, or as they put it, literal malwear.

🧠 How to Enter

Ask Hieu a question in the AMA thread before Wednesday, August 26 at 1 PM ET. You do not have to wait for him to go live, so leave your question early and he will get to it.

Some topics you can ask about:

• How the identity theft marketplace actually worked from the inside
• Getting lured to Guam by the Secret Service, and life in federal prison
• Rebuilding a cybersecurity career after prison and deportation
• Scam compounds in Southeast Asia, forced labor, and pig butchering
• How scammers choose targets, and how to protect your family

Winners will be announced Thursday, August 27th after the AMA ends!

👉 Ask your question here: https://www.reddit.com/r/pwnhub/comments/1vsf7fk/comment/p4l795e/

This giveaway is sponsored by Hudson Rock, a cybercrime intelligence company that helps detect stolen credentials from infostealer malware. They are offering free monitoring for up to 3 emails, 3 domains, and 3 usernames.

No purchase needed | One entry per person

—

📋 Official Rules:

• No purchase or payment of any kind is necessary to enter or win. This is a free sweepstakes, not a lottery.
• To enter, post a question as a comment in the linked AMA thread before Wednesday, August 26, 2026 at 1 PM ET.
• One entry per Reddit account, regardless of how many questions you ask. Alt accounts, duplicate entries, and off-topic or low-effort comments are disqualified.
• Upvotes, awards, and shares have no effect on your odds of winning.
• Five winners will be selected at random from all valid entries and announced in r/pwnhub on Thursday, August 27, 2026. Winners will also be contacted by Reddit DM and must respond within 7 days to claim their prize.
• Prizes are digital gift cards delivered by email. No cash equivalent or substitution.
• Open worldwide to entrants 18 and older, void where prohibited by law.
• Sponsored by Hudson Rock. This promotion is not sponsored, endorsed, or administered by Reddit, Hak5, or 0ff by 0ne.
• Entrants must comply with Reddit's Content Policy and the r/pwnhub rules. Entries that violate either are disqualified.

Hi PWN Community, I'm Hieu Minh Ngo, also known as Hieupc, a cybersecurity specialist from Vietnam and a former black hat hacker. I started hacking as a teenager. 

By my early twenties I was running identity theft services that sold the stolen personal data of nearly 200 million people: names, Social Security numbers, dates of birth, everything needed to steal an identity. 

In 2013 the US Secret Service lured me to Guam with a fake data deal and arrested me the moment I stepped off the plane. I was facing more than 40 years in federal prison, pleaded guilty, and was sentenced to 13 years. 

I served more than 7 years and was deported back to Vietnam in 2020. I decided to spend my second chance fighting the crime I once committed. I worked as a security expert at Vietnam's National Cyber Security Center and founded Chong Lua Dao ("Scam Fighters"), a non-profit that protects people from online scams. 

Most recently, my team collaborated with Infoblox on an investigation that traced an Android banking trojan to the K99 Triumph City scam compound in Sihanoukville, Cambodia. 

We helped rescue trafficking victims who were forced to run scams inside the compound, and the evidence they brought out let us connect specific malware to a physical scam operation for the first time. 

My story and work have been documented in a few places:

• Darknet Diaries, Episode 162: Hieu: https://darknetdiaries.com/episode/162/
• KrebsOnSecurity, "Confessions of an ID Theft Kingpin": https://krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-i/
• Infoblox, "Scams, Slaves, and Malware-as-a-Service" (the K99 Triumph City investigation): https://www.infoblox.com/blog/threat-intelligence/scams-slaves-and-malware-as-a-service-tracking-a-trojan-to-cambodias-scam-centers/
• TIME, "'A Perfect Storm': How AI Is Transforming the Global Scam Industry": https://time.com/article/2026/04/07/-a-perfect-storm-how-ai-is-transforming-the-global-scam-industry/

I also speak regularly about my story, including a TEDx talk, "The Art of Thinking Like a Cybercriminal", and I post ongoing findings on X: https://x.com/HHieupc Ask me anything about:

• How the identity theft marketplace worked from the inside, and how data on 200 million people ended up for sale
• Getting lured to Guam by the Secret Service, my arrest, and 7 years in US federal prison
• Rebuilding a life and career in cybersecurity after prison and deportation
• The scam compound economy in Southeast Asia: forced labor, pig butchering, and how these operations really run
• The K99 Triumph City investigation and tracing malware to a physical compound
• Chong Lua Dao and how we protect everyday users from scams
• How scammers pick their victims and how you can protect yourself and your family
• Anything else on hacking, identity theft, and life on both sides of the line

I'll be here live on Wednesday, August 26th from 12 PM to 1 PM ET answering your questions in real time.

Feel free to leave questions in advance, and I'll get to them when I go live. Looking forward to your questions.

Researchers broke into passkey logins using three separate attacks, targeting the login method Apple, Google, and Microsoft have pushed as phishing proof.

The attacks work on the browser and device layer rather than cracking the cryptography itself. Millions of people have already replaced passwords with passkeys on major sites.

What do you think? Are passkeys still the strongest option available, or does the phishing resistant label promise more than it delivers?

“We're Lidor B./thisis0xczar and Elad Meged, founding-team vulnerability researchers at Novee Security.

At Black Hat this year we presented pre-auth remote code execution chains in enterprise Java platforms, reaching internal execution surfaces through routing logic, unsafe deserialization, and template evaluation.

We also published research showing how a single untrusted GitHub issue could compromise the AI coding agents from Anthropic, Google, and OpenAI (Claude Code, Gemini CLI, and Codex), leading to remote code execution and credential theft.

Some of our research:

https://novee.security/blog/pre-auth-rce-in-enterprise-java/

https://novee.security/blog/critical-flaws-in-anthropic-google-and-openais-coding-agents/

Ask us anything about:

For both of us:

• Using offensive AI to find real vulnerabilities
• What it's like presenting at Black Hat Where AI and offensive security are heading
• Getting into vulnerability research and how we work
• Anything else on finding and exploiting bugs

For Lidor (enterprise Java RCE):

• Pre-auth remote code execution and how these chains come together
• Deserialization, routing logic, and template evaluation attacks
• Finding RCE in widely deployed enterprise platforms
• Enterprise and application security

For Elad (AI coding agents):

• Hijacking AI coding agents through a single GitHub issue
• Turning Claude Code, Gemini CLI, and Codex into attack vectors
• What breaks when AI agents get high-privilege access to real systems
• Hacking AI agents

We'll be here live on Monday, Aug 17 from 12 PM to 1 PM PT answering your questions in real time. “

One GitHub issue was the whole way in.

Novee Security researcher Elad Meged showed how a single issue can take over Claude Code, Gemini CLI, and Codex, reaching code execution and stolen credentials. He presented the research at Black Hat and DEF CON this year.

His research: https://novee.security/blog/critical-flaws-in-anthropic-google-and-openais-coding-agents/

He's answering questions live Monday, Aug 17, 12 to 1 PM PT. His colleague Lidor Ben Shitrit is joining the same AMA on pre-auth RCE in enterprise systems.

Ask here: https://www.reddit.com/r/pwnhub/comments/1vn9t90/were_lidor_bthisis0xczar_and_elad_meged_novee/

No account, no credentials, no user interaction. Just the right request.

That's pre-auth RCE, and Novee Security researcher Lidor Ben Shitrit pulled it off against the platforms large companies run. He presented the work at Black Hat and DEF CON this year.

His research: https://novee.security/blog/pre-auth-rce-in-enterprise-java/

He's answering questions live Monday, Aug 17, 12 to 1 PM PT. His colleague Elad Meged is joining the same AMA to talk about hijacking AI coding agents.

Ask here: https://www.reddit.com/r/pwnhub/comments/1vn9t90/were_lidor_bthisis0xczar_and_elad_meged_novee/